Threats Tagged 'ghsa-crrc-vpp2-f5x7'
View all threats tagged with 'ghsa-crrc-vpp2-f5x7'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-crrc-vpp2-f5x7'
Click on any threat for detailed analysis and mitigation recommendations
CVE-2026-76846 is a vulnerability in the Grav CMS where sensitive credentials stored under the 'system' configuration namespace, such as Redis cache passwords, are exposed to users with page-edit permissions when certain documented Twig sandbox settings are enabled. This occurs because the default denylist for the Twig sandbox configuration omits the 'system' prefix, allowing secret values to be accessed via config.get() and config.toArray() methods in sandboxed Twig templates. The issue affects Grav versions prior to 2.0.16. The vulnerability has a high severity score of 8.7 and allows unauthenticated remote attackers to obtain sensitive configuration secrets without requiring privileges beyond page-edit permission. Join the discussion | CVE Database V5 | 09/17/2026, 20:27:05 UTC Added: 08/25/2026, 01:52:59 UTC |
Grav versions before 2.0.16 have an incomplete default denylist in the Twig sandbox configuration, which allows attackers with page-edit permissions to access sensitive system configuration secrets such as system.cache.redis.password when config_access is enabled. This vulnerability can lead to exposure of critical secrets through Twig templates. Join the discussion | GCVE Database | 08/25/2026, 03:32:10 UTC Added: 09/18/2026, 01:03:45 UTC |
Showing 1 to 2 of 2 results